What is the Security Event Logging service?

Overview

The Security Event Logging service (formerly known as the Log Correlation Program) provides a centralized platform for collecting and analyzing security-related events from campus IT resources. By aggregating logs from various systems, the Information Security Office (ISO) can more effectively detect, investigate, and respond to security incidents across the university network.

Requirements

In accordance with campus security policy, event logging is required for systems handling Protection Level 4 (P4) data. To participate in the service:

• Assets must be registered in Socreg with accurate security contacts.
• Systems must be configured to forward logs to the central security information and event management (SIEM) system.

Related Resources

• KB0012137 - What is Socreg?
• KB0014777 - How to Send AWS CloudWatch Logs to UC Berkeley Security

 

For technical support or to request log integration, please contact security-logs@berkeley.edu.